<html><head></head><body><div>Good Afternoon,</div><div><br></div><div>I have a newly configured bind9 server with two dynamic zones that I cannot seem to get working. I've ensured I have a key-directory configured and I've confirmed that the keys exist and are readable by bind but I'm unable to resolve the issue. The zones themselves work fine, but dynamic updates are failing. If it's relevant, bind is running inside an LXD container.</div><div><br></div><div>Logs:</div><div><br></div><div>Mar 29 15:50:39 bind named[99]: client 192.168.0.3#2093/key ddns_update: signer "ddns_update" approved</div><div>Mar 29 15:50:39 bind named[99]: client 192.168.0.3#2093/key ddns_update: updating zone 'mcguire.local/IN': adding an RR at 'am335x-opt.mcguire.local' A 192.168.0.165</div><div>Mar 29 15:50:39 bind named[99]: client 192.168.0.3#2093/key ddns_update: updating zone 'mcguire.local/IN': adding an RR at 'am335x-opt.mcguire.local' TXT "3154a902d1b045a4064274c0d6b5</div><div>Mar 29 15:50:39 bind named[99]: dns_dnssec_findzonekeys2: error reading private key file mcguire.local/RSASHA256/43356: file not found</div><div>Mar 29 15:50:39 bind named[99]: dns_dnssec_findzonekeys2: error reading private key file mcguire.local/RSASHA256/43345: file not found</div><div>Mar 29 15:50:39 bind named[99]: client 192.168.0.3#2093/key ddns_update: updating zone 'mcguire.local/IN': found no active private keys, unable to generate any signatures</div><div>Mar 29 15:50:39 bind named[99]: client 192.168.0.3#2093/key ddns_update: updating zone 'mcguire.local/IN': RRSIG/NSEC/NSEC3 update failed: not found</div><div><br></div><div>Zone config:</div><div><br></div><div>zone "0.168.192.in-addr.arpa" IN {</div><div> type master;</div><div> file "/etc/bind/zones/db.0.168.192.in-addr.arpa.signed";</div><div> auto-dnssec maintain;</div><div> key-directory "/etc/bind/keys";</div><div> inline-signing yes;</div><div> allow-update { key DDNS_UPDATE; };</div><div>};</div><div>zone "mcguire.local" IN {</div><div> type master;</div><div> file "/etc/bind/zones/db.mcguire.local.signed";</div><div> auto-dnssec maintain;</div><div> key-directory "/etc/bind/keys";</div><div> inline-signing yes;</div><div> allow-update { key DDNS_UPDATE; };</div><div>};</div><div><br></div><div>Key directory and relevant keys:</div><div><br></div><div>File: /etc/bind/keys/</div><div>[...]</div><div>Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 112/ bind)</div><div><br></div><div>-rw-r--r-- 1 bind bind 627 Mar 28 12:11 K0.168.192.in-addr.arpa.+008+04239.key</div><div>-rw-r----- 1 bind bind 1776 Mar 28 12:11 K0.168.192.in-addr.arpa.+008+04239.private</div><div>-rw-r--r-- 1 bind bind 972 Mar 28 12:12 K0.168.192.in-addr.arpa.+008+05959.key</div><div>-rw-r----- 1 bind bind 3316 Mar 28 12:12 K0.168.192.in-addr.arpa.+008+05959.private</div><div>-rw-r--r-- 1 bind bind 955 Mar 28 12:11 Kmcguire.local.+008+43345.key</div><div>-rw-r----- 1 bind bind 3316 Mar 28 12:11 Kmcguire.local.+008+43345.private</div><div>-rw-r--r-- 1 bind bind 610 Mar 28 12:11 Kmcguire.local.+008+43356.key</div><div>-rw-r----- 1 bind bind 1776 Mar 28 12:11 Kmcguire.local.+008+43356.private</div><div><br></div><div>Any ideas?</div><div><br></div><div>Regards,</div><div><br></div><div>-Ryan</div></body></html>